2

On XP when Windows updates are ready to install, they run in a special UI during the shutdown process after all users have logged-out.

How is this achieved?

Does the CSRSS or other windows management component launch the Windows Update UI App as a special case not available to normal programmers?

Does it run as some kind of Shutdown Script?

Or does it use Kernel Mode?

What, if any, Executable or module is responsible for displaying that UI?

0

1 Answer 1

2

That UI belongs to Winlogon, which specifically loads & calls a Windows Update DLL during the shutdown sequence. The text comes from Windows Update via a callback.

Winlogon calls different internal functions in response to session state changes (logon, logoff, startup, shutdown, etc.) Where I investigated, in XP, one of the functions called during shutdown is WUNotify. It dynamically loads wuaueng.dll, calls GetProcAddress on ordinal 5 (WUAutoUpdateAtShutdown), and calls that function with a bool flag and a function pointer to StatusMessage2. WUAutoUpdateAtShutdown in turn communicates out-of-process with the Windows Update service to do its work, and uses StatusMessage2 to update Winlogon's UI text ("Installing update 1 of 10", etc.)

Prior to Vista, you could create your own Winlogon notify DLL, and with the appropriate registry keys, Winlogon would load your module and call your exports for the notifications you were interested in. Another way of doing it, also pre-Vista, was to write your own GINA DLL.

Nowadays, you can run at shutdown using a service notification (though you don't have a lot of time here) or a GPO shutdown script (which is subject to registry timeout constraints). I don't know if the Winlogon status window exists when these things run, but if so, you might be able to look up the HWND, and use SetWindowText directly to alter Winlogon's status message. (This is how StatusMessage2 ultimately works. Though it might be neat to do from a shutdown script as "proof of concept", it is obviously not a supported or recommended behavior.)

You must log in to answer this question.